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* See the attached detailed Office action for a list of the certified copies not received. 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 19(e) (to a provisional application). 
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DETAILED ACTION 

Claims 1-38 have been examined. 

Claim Rejections - 35 USC §101 

Claims 1-38 are rejected under 35 U.S.C. 101 because the claimed invention is directed 
to non-statutory subject matter. 

The basis of this rejection is set forth in a two-prong test of: 

(1) whether the invention is within the technological arts; and 

(2) whether the invention produces a useful, concrete, and tangible result. 

For a claimed invention to be statutory, the claimed invention must be within the 
technological arts. Mere ideas in the abstract (i.e., abstract idea, law of nature, natural 
phenomena) that do not apply, involve, use, or advance the technological arts fail to promote the 
"progress of science and the useful arts" (i.e., the physical sciences as opposed to social sciences, 
for example) and therefore are found to be non-statutory subject matter. For a process claim to 
pass muster, the recited process must somehow apply, involve, use, or advance the technological 
arts. 

In the present case, claims land 21 only recite an abstract idea. The recited steps of 
merely informing an individual about the disclosure of personal information, and verifying that 
this disclosure complies with local laws does not apply, involve, use, or advance the 
technological arts since all of the recited steps can be performed in the mind of the user or by use 
of a pencil and paper. These steps only constitute an idea of how to inform an individual about 
the status of their privacy rights. 

Additionally, for a claimed invention to be statutory, the claimed invention must produce 
a useful, concrete, and tangible result. In the present case, the claimed invention produces 
consent from an individual (i.e., repeatable) in regards to the release of their private data (i.e., 
useful and tangible). 

Although the recited process produces a useful, concrete, and tangible result, since the 
claimed invention, as a whole, is not within the technological arts as explained above, claim 1 is 
deemed to be directed to non-statutory subject matter. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made, 
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Claims 1-5,7-9,16,17,19-27,34,35 and 37-38 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Coueignoux (US Patent 6,092,197). 

As per claim 1, 

Coueignoux ('197) discloses a method for promoting compliance with data protection 
and privacy laws and regulations relating to the privacy rights of individual; that comprises: 

informing an individual involved in potential disclosure of his/her personal data to an 
entity that the entity has certified its compliance with approved privacy and data security 
practices that conform to relevant data protection and privacy laws and regulations covering the 
use of personal data in at least the individual's or entity's country of location;(Column 2, lines 39- 
61) 

obtaining the individual's consent to have the entity receive, or acknowledgment that the 
entity will receive, and use his/her personal data in accordance with a stated policy or with 
relevant data protection and privacy laws and regulations covering a use of personal data m at 
least the individual's or the entity's country of location; (Column 3, lines 15-28) 

transmitting to the entity data indicating that t 7c individual has been informed of the 
entity's privacy practices and consented to the entity receiving, or acknowledged that the entity 
will be receiving, and using his/her personal data in accordance with its stated policy or with 
relevant data protection and privacy laws and regulations covering the use of personal data in at 
least the individual's or the entity's country a location;(Column 2, lines 39-61) 

receiving from the entity data comprising per, personal data collected by the entity from 
the individual; storing said personal data received from the entity; (Figure 1) 

Official Notice is taken that "periodically checking whether the entity has complied with 
the stated policy or with relevant data protection and privacy laws and regulation covering the 
use of personal data in at least the individual's or the entity's country of location." is common and 
well known in prior art in reference to compliance with data protection and privacy laws. It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to periodically check whether the entity has complied with the stated policy or with 
relevant data protection and privacy laws and regulation covering the use of personal data in at 
least the individual's or the entity's country of location in order to in order to allow the entity to 
correct any inadvertent violations of privacy laws that might have occurred 

As per claim 2, 

Coueignoux ('197) discloses a method according to claim 1 . 

Official Notice is taken that " informing the individual that the entity is covered by 
insurance or equivalent risk: instrument to protect against risk of loss of harm caused to the 
individual arising from misuse or loss of the individual's personal data by the entity." is common 
and well known in prior art in reference to compliance with data protection and privacy laws. It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to inform the individual that the entity is covered by insurance or equivalent risk: 
instrument to protect against risk of loss of harm caused to the individual arising from misuse or 
loss of the individual's personal data by the entity in order to in order to promote consumer 
confidence in the system. 
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As per claim 3, 

Coueignoux ('197) discloses a method according to claim 1 

wherein said data indicating that the individual has consented to have the entity receive, 
or acknowledgment that the entity will receive, and use the individual's personal data comprises 
data uniquely identifying details relating to the individual's consent.(Column 5, lines 44-64) 

As per claim 4, 

Coueignoux ('197) discloses a method according to claim 3 

wherein said data indicating that the individual has consented to have the entity receive, 
or acknowledgement that the entity will receive, and use the individual's personal data and 
uniquely identifying details relating to the individual's consent is compressed using a hash 
function.(Column 13, lines 43-51) 

As per claim 5, 

Coueignoux ('197) discloses a method according to claim 4 

wherein said data received from the entity comprising personal data collected by the 
entity from :lie individual, includes the data transmitted to the entity uniquely identifying details 
relating to the individual's consent.(Column 6, lines 59-62) 

As per claim 7, 

Coueignoux ('197) discloses a method according to claim 1 

Official Notice is taken that " performed with a multiplicity of entities and individuals 
located in a multiplicity of countries" is common and well known in prior art in reference to 
compliance with data protection and privacy laws. It would have been obvious to one having 
ordinary skill in the art at the time the invention was made to perform with a multiplicity of 
entities and individuals located in a multiplicity of countries in order to maximize efficiency by 
processing multiple entities at a single time. 

As per claim 8, 

Coueignoux ( c 197) discloses a method according to claim 1 

Official Notice is taken that " the individual is informed in an official language of the 
individual's country of location" is common and well known in prior art in reference to 
compliance with data protection and privacy laws. It would have been obvious to one having 
ordinary skill in the art at the time the invention was made to inform the individual in an official 
language of the individual's country of location in order to allow the individual to comprehend 
the message, and provide a useful service. 

As per claim 9, 

Coueignoux ('197) discloses a method according to claim 1 
conducted as a multi-entity privacy policy certification program requiring member 
entities to certify compliance with approved privacy standards for the use of personal data of 
individuals and providing such entities with a policy notice to confirm their approval by, and 
membership in, the program. (Column 2, lines 39-61) 
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As per claim 16, 

Coueignoux ('197) discloses a method according to claim 1 

Wherein the data received from the entity comprising the individual's stored personal 
data includes the time period of the individual's consent or acknowledgment, the length of time 
that the individual's personal data will be retained, and an option to extend or renew the 
individual's consent or acknowledgment, if desired, notice thereof being provided to the entity an 
a the individual in advance of expiration of the consent. (Column 5, lines 44-64) 

As per claim 17, 

Coueignoux ('197) discloses a method according to claim 16 

wherein the individual is provided with the option of having the individual's personal data 
deleted from the entity's data storage upon expiration of the agreement.(Column 16, lines 43-56) 

As per claim 19, 

Coueignoux ('197) discloses a method according to claim 1, 

wherein the steps of informing the individual, obtaining the individual's consent or 

acknowledgment, transmitting, data to the entity, and receiving data from the entity are 

performed over a computer network. (Figure 1) 

As per claim 19, 

Coueignoux ('197) discloses a method according to claim 19, 
wherein the computer network is the Internet.(Figure 1) 

As per claim 21, 

Coueignoux ('197) discloses a system for promoting compliance with data protection and 
privacy laws and regulations relating to the privacy rights of individual; that comprises: 

means for informing an individual involved in potential disclosure of his/her personal 
data to an entity that the entity has certified its compliance with approved privacy and data 
security practices that conform to relevant data protection and privacy laws and regulations 
covering the use of personal data in at least the individual's or the entity's country of 
location;(Column 2, lines 39-61) 

means for obtaining the individual's consent t have the entity receive, or acknowledgment 
that the entity will receive, and use 1 his/her personal data in accordance with a stated policy or 
with relevant data protection and privacy laws arid regulations covering the use of personal data 
in at least the individual's or the entity's country of location;(Column 3, lines 15-28) 

means for transmitting to the entity data indicating, that the individual has been informed 
of the entity's privacy practices and consent to the entity, receiving, or acknowledgment that the 
entity will be receiving, and using his/her personal data in accordance with its stated policy or 
with relevant data protection and privacy laws and 

regulations covering the use of personal data in at least the individual's or the entity's country of 
location;(Column 2, lines 39-61) 

means for receiving from the entity data comprising personal data collected by the entity 
from the individual and means for storing said personal data received from the entity ;(Figure 1) 



Application/Control Number: 09/754,898 
Art Unit: 3621 



Page 6 



Official Notice is taken that "periodically checking whether the entity has complied with 
the stated policy or with relevant data protection and privacy laws and regulation covering the 
use of personal data in at least the individual's or the entity's country of location." is common and 
well known in prior art in reference to compliance with data protection and privacy laws. It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to periodically check whether the entity has complied with the stated policy or with 
relevant data protection and privacy laws and regulation covering the use of personal data in at 
least the individual's or the entity's country of location in order to in order to allow the entity to 
correct any inadvertent violations of privacy laws that might have occurred 

As per claim 22, 

Coueignoux ('197) discloses a system according to claim 21 . 

Official Notice is taken that " informing the individual that the entity is covered by 
insurance or equivalent risk: instrument to protect against risk of loss of harm caused to the 
individual arising from misuse or loss of the individual's personal data by the entity." is common 
and well known in prior art in reference to compliance with data protection and privacy laws. It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to inform the individual that the entity is covered by insurance or equivalent risk: 
instrument to protect against risk of loss of harm caused to the individual arising from misuse or 
loss of the individual's personal data by the entity in order to in order to promote consumer 
confidence in the system. 

As per claim 23, 

Coueignoux ( c 197) discloses a system according to claim 21 

wherein said data indicating that the individual has consented to have the entity receive, 
or acknowledgment that the entity will receive, and use the individual's personal data comprises 
data uniquely identifying details relating to the individual's consent.(Column 5, lines 44-64) 

As per claim 24, 

Coueignoux ( c 197) discloses a system according to claim 23 

wherein said data indicating that the individual has consented to have the entity receive, 
or acknowledgement that the entity will receive, and use the individual's personal data and 
uniquely identifying details relating to the individual's consent is compressed using a hash 
function.(Column 13, lines 43-51) 

As per claim 25, 

Coueignoux ( c 197) discloses a system according to claim 24 

wherein said data received from the entity comprising personal data collected by the 

entity from :lie individual, includes the data transmitted to the entity uniquely identifying details 

relating to the individual's consent.(Column 6, lines 59-62) 

As per claim 26, 

Coueignoux ('197) discloses a system according to claim 21 
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Official Notice is taken that " the individual is informed in an official language of the 
individual's country of location" is common and well known in prior art in reference to 
compliance with data protection and privacy laws. It would have been obvious to one having 
ordinary skill in the art at the time the invention was made to inform the individual in an official 
language of the individual's country of location in order to allow the individual to comprehend 
the message, and provide a useful service. 

As per claim 27, 

Coueignoux ('197) discloses a system according to claim 21 
conducted as a multi-entity privacy policy certification program requiring member 
entities to certify compliance with approved privacy standards for the use of personal data of 
individuals and providing such entities with a policy notice to confirm their approval by, and 
membership in, the program.(Column 2, lines 39-61) 

As per claim 34, 

Coueignoux ('197) discloses a system according to claim 21 

Wherein the data received from the entity comprising the individual's stored personal 
data includes the time period of the individual's consent or acknowledgment, the length of time 
that the individual's personal data will be retained, and an option to extend or renew the 
individual's consent or acknowledgment, if desired, notice thereof being provided to the entity an 
a the individual in advance of expiration of the consent.(Column 5, lines 44-64) 

As per claim 35, 

Coueignoux ('197) discloses a system according to claim 34 

wherein the individual is provided with the option of having the individual's personal data 
deleted from the entity's data storage upon expiration of the agreement. (Column 16, lines 43-56) 

As per claim 37, 

Coueignoux ( fi 197) discloses a system according to claim 21, 

wherein the steps of informing the individual, obtaining the individual's consent or 

acknowledgment, transmitting, data to the entity, and receiving data from the entity are 

performed over a computer network.(Figure 1) 

As per claim 38, 

Coueignoux ('197) discloses a system according to claim 37, 
wherein the computer network is the Internet.(Figure 1) 

Claims 6,10 and 28 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Coueignoux (US Patent 6,092,197) in view of Clayton et al. (US Patent application 
09/754898) 

As per claim 6, 

Coueignoux (' 1 97) discloses a method according to claim 1 
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Coueignoux ('197) does not explicitly disclose "performed with a multiplicity of entities 
and individuals located in a single country", Clayton et al. discloses "performed with a 
multiplicity of entities and individuals located in a single country".( Page 2, lines 26-28) It 
would have been obvious to one having ordinary skill in the art at the time the invention was 
made to combine the Coueignoux ('197) method with the Clayton et al. method in order to 
maximize efficiency by processing multiple entities at a single time. 

As per claim 10, 

Coueignoux ('197) discloses a method according to claim 9 
Coueignoux ('197) does not explicitly disclose "the approved standards meet the 
standards required by the United States, European Union, or other countries or regional 
organizations. 5 ', Clayton et al. discloses "the approved standards meet the standards required by 
the United States, European Union, or other countries or regional organizations. ".( Page 1, lines 
28-3 1) It would have been obvious to one having ordinary skill in the art at the time the 
invention was made to combine the Coueignoux ('197) method with the Clayton et al. method in 
order in order to allow the individual to provide a useful service. 

As per claim 28, 

Coueignoux ('197) discloses a system according to claim 27 
Coueignoux ('197) does not explicitly disclose "the approved standards meet the 
standards required by the United States, European Union, or other countries or regional 
organizations.", Clayton et al. discloses "the approved standards meet the standards required by 
the United States, European Union, or other countries or regional organizations. ".( Page 1, lines 
28-3 1) It would have been obvious to one having ordinary skill in the art at the time the 
invention was made to combine the Coueignoux ('197) method with the Clayton et al. method in 
order in order to allow the individual to provide a useful service. 



Claims 1 1-15,18,29-33 and 36 are objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the base 
claim and any intervening claims and complying with double patenting statutes. 

Any comments considered necessary by applicant must be submitted no later than the 
payment of the issue fee and, to avoid processing delays, should preferably accompany the issue 
fee. Such submissions should be clearly labeled "Comments on Statement of Reasons for 
Allowance." 



Examiners note: Examiner has cited particular columns and line numbers in the 
references as applied to the claims above for the convenience of the applicant. Although the 
specified citations are representative of the teachings of the art and are applied to the specific 
limitations within the individual claim, other passages and figures may apply as well. It is 



Allowable Subject Matter 



Conclusion 
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respectfully requested from the applicant in preparing responses, to fully consider the references 
in entirety as potentially teaching all or part of the claimed invention, as well as the context of 
the passage as taught by the prior art or disclosed by the examiner. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to John M Winter whose telephone number is (703) 305-3971 . The 
examiner can normally be reached on M-F 8:30-6, 1st Fridays off. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, James P Trammell can be reached on (703)305-9768. The fax phone numbers for the 
organization where this application or proceeding is assigned are (703) 305-7687 for regular 
communications and (703) 305-7687 for After Final communications. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (703) 308-1 1 13. 



JMW 

May 15,2003 



